Moxa Issues Fix for Critical Authentication Bypass Vulnerability in PT Switches
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-12297 | Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device. NVD description · AI analysis pending | 9.2 | <1% | — | — | ||
| CVE-2024-7695 | Multiple switches are affected by an out-of-bounds write vulnerability. Multiple switches are affected by an out-of-bounds write vulnerability. This vulnerability is caused by insufficient input validation, which allows data to be written to memory outside the bounds of the buffer. Successful exploitation of this vulnerability could result in a denial-of-service attack. NVD description · AI analysis pending | 8.7 | <1% | — | — | ||
| CVE-2024-9137 | The affected product lacks an authentication check when sending commands to the server via the Moxa service. The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise. NVD description · AI analysis pending | 8.8 | <1% | — | — | ||
| CVE-2024-9138 | Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain root-level access to the system, posing a significant security risk. NVD description · AI analysis pending | 8.6 | 1% | — | — | ||
| CVE-2024-9140 | Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulnerability allows OS command injection due to improperly restricted commands, potentially enabling attackers to execute arbitrary code. This poses a significant risk to the system’s security and functionality. NVD description · AI analysis pending | 9.3 | 2% | — | — | ||
| CVE-2024-9404 | This vulnerability could lead to denial-of-service or service crashes. This vulnerability could lead to denial-of-service or service crashes. Exploitation of the moxa_cmd service, because of insufficient input validation, allows attackers to disrupt operations. If exposed to public networks, the vulnerability poses a significant remote threat, potentially allowing attackers to shut down affected systems. NVD description · AI analysis pending | 8.7 | <1% | — | — |
Full article414 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 11, 2025ICS Security / Vulnerability
Taiwanese company Moxa has released a security update to address a critical security flaw impacting its PT switches that could permit an attacker to bypass authentication guarantees.
The vulnerability, tracked as CVE-2024-12297, has been assigned a CVSS v4 score of 9.2 out of a maximum of 10.0.
"Multiple Moxa PT switches are vulnerable to an authentication bypass because of flaws in their authorization mechanism," the company said in an advisory released last week.
"Despite client-side and back-end server verification, attackers can exploit weaknesses in its implementation. This vulnerability may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device."
Successful exploitation of the shortcoming, in other words, could lead to an authentication bypass and allow an attacker to gain unauthorized access to sensitive configurations or disrupt services.
The flaw impacts the following versions -
- PT-508 Series (Firmware version 3.8 and earlier)
- PT-510 Series (Firmware version 3.8 and earlier)
- PT-7528 Series (Firmware version 5.0 and earlier)
- PT-7728 Series (Firmware version 3.9 and earlier)
- PT-7828 Series (Firmware version 4.0 and earlier)
- PT-G503 Series (Firmware version 5.3 and earlier)
- PT-G510 Series (Firmware version 6.5 and earlier)
- PT-G7728 Series (Firmware version 6.5 and earlier), and
- PT-G7828 Series (Firmware version 6.5 and earlier)
Patches for the vulnerability can be obtained by contacting the Moxa Technical Support team. The company credited Artem Turyshev from Moscow-based Rosatom Automated Control Systems (RASU) for reporting the vulnerability.
Outside apply the latest fixes, companies using the affected products are recommended to restrict network access using firewalls or access control lists (ACLs), enforce network segmentation, minimize direct exposure to the internet, implement multi-factor authentication (MFA) for accessing critical systems, enable event logging, and monitor network traffic and device behavior for unusual activities.
It's worth noting that Moxa resolved the same vulnerability in the Ethernet switch EDS-508A Series, running firmware version 3.11 and earlier, back in mid-January 2025.
The development comes a little over two months after Moxa rolled out patches for two security vulnerabilities impacting its cellular routers, secure routers, and network security appliances (CVE-2024-9138 and CVE-2024-9140) that could allow privilege escalation and command execution.
Last month, it also addressed multiple high-severity flaws affecting various switches (CVE-2024-7695, CVE-2024-9404, and CVE-2024-9137) that could result in a denial-of-service (DoS) attack, or command execution.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/03/moxa-issues-fix-for-critical.html